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AMENDMENTS TO THE CLAIMS 

Please amend the claims as follows: 

1 . (Currently amended) A computer implemented method for gleaning file 
attributes independently of file format, the method comprising the steps of: 

a non - application specific non-application-specific file attribute manager 
receiving a plurality of files in a plurality of formats; 

the file attribute manager scanning the plurality of received files in the plurality 
of formats; 

the file attribute manager gleaning file attributes from each of the plurality of 
scanned files in the plurality of formats; 

the file attribute manager storing the gleaned file attributes gleaned from each of 
the plurality of scanned files as a plurality of records in a database; 

the file attribute manager indexing specific file attributes gleaned from [[a]] 

specific file files according to contents of the specific files , the specific 
file attributes being stored as em ones of the plurality of records in the 
database , the indexing proceeding according to contents of th e sp e cific 
file" 

examining one of the plurality of files; 

retrieving from the plurality of records in the database at least one record 
associated with the examined one of the plurality of files; 

analyzing the gleaned file attributes gleaned from the examined one of the 

plurality of files, the gleaned file attributes having been retrieved from 
the at least one record associated with the file examined one of the 
plurality of files ; and 

determining a status of the examined one of the plurality of files responsive to 
analyzing the gleaned file attributes. 

2. (Currently amended) The method of claim 1 wherein: 

the specific types of file attributes are gleaned from the a specific file are as a 
function of a protocol according to which the specific file is transmitted. 
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3. (Currently amended) The method of claim 1 wherein: 

the specific types of file attributes are gleaned from the a specific file are as a 
function of the a format of the specific file. 

4. (Currently amended) The method of claim 1 wherein the file attribute 
manager indexing specific file attributes proceeds indexes according to a secure hash of the 
contents of the each specific file. 

5. (Currently amended) The method of claim 1 wherein the file attribute 
manager indexing specific file attributes proceeds indexes according to a cyclical 
redundancy check of the contents of the each specific file. 



6. (Previously presented) The method of claim 1 further comprising: 

the file attribute manager receiving a plurality of copies of a selected file of the 

plurality of files; and 
the file attribute manager storing each of the plurality of copies as a separate 

record in the plurality of records, each separate record indexed according 
to the contents of the selected file of the plurality of files, such that the 
each separate record can be accessed by a single index. 



7. (Original) The method of claim 1 further comprising: 

deleting records from the database after the records have been stored for a 
specific period of time. 

8. (Currently amended) The method of claim 1 wherein the non - application 
specific non-application-specific file attribute manager is incorporated into one selected 
from the group consisting of: 

a firewall; 

an intrusion detection system; 

an intrusion detection system application proxy; 

a router; 

a switch; 
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a standalone proxy; 
a server; 
a gateway; 

an anti-virus detection system; and 
a client. 

9. (Currently amended) A computer readable computer-readable medium 
containing a computer program product for gleaning file attributes independently of file 
format, the computer program product comprising program code for: 
receiving a plurality of files in a plurality of formats; 
scanning the plurality of received files in the plurality of formats; 
gleaning file attributes from each of the plurality of scanned files in the plurality 
of formats; 

storing the gleaned file attributes gleaned from each of the plurality of scanned 
files as a plurality of records in a database; 

indexing specific file attributes gleaned from [[a]] specific file files according to 
contents of the specific files , the specific file attributes being stored as 
one ones of the plurality of records in the database , th e ind e xing 
proceeding according to contents of the specific file ; 

examining one of the plurality of files; 

retrieving from the plurality of records in the database at least one record 
associated with the one of the examined plurality of files; 

analyzing the gleaned file attributes gleaned from the examined one of the 

plurality of files, the gleaned file attributes having been retrieved from 
the at least one record associated with the file examined one of the 
plurality of files ; and 

determining a status of the examined one of the plurality of files responsive to 
analyzing the gleaned file attributes. 
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10. (Currently amended) The computer program product of claim 9 further 
comprising: 

program code for gleaning specific types of file attributes from the a specific 
file as a function of a protocol according to which the specific file is 
transmitted. 

1 1 . (Currently amended) The computer program product of claim 9 further 
comprising: 

program code for gleaning specific types of file attributes from the a specific 
file as a function of the a format of the specific file. 

12. (Currently amended) The computer program product of claim 9 wherein the 
program code for indexing file attributes proceeds indexes according to a secure hash of the 
contents of the each specific file. 

13. (Currently amended) The computer program product of claim 9 wherein the 
program code for indexing file attributes proceeds indexes according to a cyclical 
redundancy check of the contents of the each specific file. 

14. (Previously presented) The computer program product of claim 9 further 
comprising: 

program code for receiving a plurality of copies of a selected file of the plurality 
of files; and 

program code for storing each of the plurality of copies as a separate record in 
the plurality of records, each separate record indexed according to the 
contents of the selected file of the plurality of files, such that the each 
separate record can be accessed by a single index. 

15. (Original) The computer program product of claim 9 further comprising: 
program code for deleting records from the database after the records have been 

stored for a specific period of time. 
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16. (Currently amended) A computer system for gleaning file attributes 
independently of file format, the computer system comprising: 

a reception module, configured to receive a plurality of files in a plurality of 
formats; 

a scanning module, configured to scan the plurality of received files in the 

plurality of formats, the scanning module communicatively coupled to 
the reception module; 

a gleaning module, configured to glean file attributes from each of the plurality 
of scanned files in the plurality of formats, the gleaning module 
communicatively coupled to the scanning module; 

a storage module, configured to store gleaned file attributes gleaned from each 
of the plurality of scanned files as a plurality of records in a database, 
the storage module communicatively coupled to the gleaning module; 

an indexing module, configured to index specific file attributes gleaned from 
[[a]] specific -file files according to contents of the specific files, the 
specific file attributes being stored as eee ones of the plurality of records 
in the database , the indexing proceeding according to cont e nts of th e 
specific file , the indexing module communicatively coupled to the 
storage module; 

an examining module, configured to examine one of the plurality of files; 

a retrieval module, configured to retrieve from the plurality of records in the 
database at least one record associated with the examined one of the 
plurality of files, the retrieval module communicatively coupled to the 
examining module and the storage module; 

an analysis module, configured to analyze the gleaned file attributes gleaned 

from the examined one of the plurality of files, the gleaned file attributes 
having been retrieved from the at least one record associated with the 
file examined one of the plurality of files, the analysis module 
communicatively coupled to the retrieval module; and 

a status module, configured to determining a status of the examined one of the 
plurality of files responsive to analyzing the gleaned file attributes, the 
status module communicatively coupled to the analysis module. 
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17. (Currently amended) The computer system of claim 16 wherein: 
the gleaning module is further configured to glean specific types of file 

attributes from a specific file which arc as a function of a protocol 
according to which the specific file is transmitted. 



1 8 . (Currently amended) The computer system of claim 1 6 wherein: 
the gleaning module is further configured to glean specific types of file 

attributes from a specific file which arc as a function of the a format of 
the specific file. 

19. (Currently amended) The computer system of claim 16 wherein the indexing 
module is further configured to index specific file attributes proceeds according to a secure 
hash of the contents of the each specific file. 

20. (Currently amended) The computer system of claim 16 wherein the indexing 
module is further configured to index specific file attributes proceeds according to a 
cyclical redundancy check of the contents of the each specific file. 

2 1 . (Previously presented) The computer system of claim 1 6 wherein: 

the reception module is further configured to receive a plurality of copies of a 
selected file of the plurality of files; and 

the storage module is further configured to store each of the plurality of copies 
as a separate record in the plurality of records, each separate record 
indexed according to the contents of the selected file of the plurality of 
files,-such that the each separate record can be accessed by a single 
index. 



22. (Cancelled). 

23. (Cancelled) 
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24. (Currently amended) The method of claim 1 further comprising: 
responsive to determining the status of the examined one of the plurality of files 

to be malicious, blocking the examined one of the plurality of files. 

25. (Currently amended) The method of claim 1 further comprising: 
responsive to determining the status of the examined one of the plurality of files 

to be legitimate, not blocking the examined one of the plurality of files. 

26. (Currently amended) The method of claim 1 further comprising: 
applying at least one rule specifying how to use the gleaned file attributes to 

process the examined one of the plurality of files. 

27. (Currently amended) The method of claim 26 further comprising: 
selecting the at least one rule from a plurality of rules to apply specifying how 

to use the gleaned file attributes to process the examined one of the 
plurality of files. 

28. (New) The method of claim 1, wherein the plurality of files are received 
from a network connection. 
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